LOGOFF.exe

Log a user off.

Syntax
LOGOFF [/f] [/n]
Key
/f Force running processes to close, but will ask for user confirmation.
The user will not be asked to save unsaved data.
/n Force running processes to close without confirmation.
The user will be prompted to save unsaved data.

By default LOGOFF will ask for user confirmation and prompt to save unsaved data.

Windows security log events

Logon Event IDs 528 and 540 = successful logon

Logoff Event ID 538 = logoff

Logon and logoff events also specify a Logon Type code:

Logon Type 2 – Interactive - Log on at the local keyboard / screen (see the event description for a computer name).